From 119eddd220de2abeb024c9727b8d375c0dec9334 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Tue, 5 Apr 2022 17:18:51 -0300 Subject: [PATCH 1/6] Misc fixes --- build-docker-images/wazuh-dashboard/Dockerfile | 9 +-------- build-docker-images/wazuh-dashboard/config/wazuh.yml | 6 ------ .../wazuh-indexer/config/roles_mapping.yml | 4 ++-- multi-node/config/wazuh_indexer/wazuh1.indexer.yml | 4 ++-- multi-node/config/wazuh_indexer/wazuh2.indexer.yml | 4 ++-- multi-node/config/wazuh_indexer/wazuh3.indexer.yml | 4 ++-- single-node/config/wazuh_indexer/wazuh.indexer.yml | 6 +++++- 7 files changed, 14 insertions(+), 23 deletions(-) diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index 8f38685f..8a40a99c 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -79,14 +79,7 @@ ENV PATTERN="" \ WAZUH_MONITORING_FREQUENCY="" \ WAZUH_MONITORING_SHARDS="" \ WAZUH_MONITORING_REPLICAS="" \ - ADMIN_PRIVILEGES="" \ - XPACK_CANVAS="true" \ - XPACK_LOGS="true" \ - XPACK_INFRA="true" \ - XPACK_ML="true" \ - XPACK_DEVTOOLS="true" \ - XPACK_MONITORING="true" \ - XPACK_APM="true" + ADMIN_PRIVILEGES="" # Create wazuh-dashboard user and group RUN getent group $GROUP || groupadd -r -g 1000 $GROUP diff --git a/build-docker-images/wazuh-dashboard/config/wazuh.yml b/build-docker-images/wazuh-dashboard/config/wazuh.yml index aeb519f7..2c5649d7 100644 --- a/build-docker-images/wazuh-dashboard/config/wazuh.yml +++ b/build-docker-images/wazuh-dashboard/config/wazuh.yml @@ -77,12 +77,6 @@ # List of index patterns to be ignored #ip.ignore: [] # -# -------------------------------- X-Pack RBAC --------------------------------- -# -# Custom setting to enable/disable built-in X-Pack RBAC security capabilities. -# Default: enabled -#xpack.rbac.enabled: true -# # ------------------------------ wazuh-monitoring ------------------------------ # # Custom setting to enable/disable wazuh-monitoring indices. diff --git a/build-docker-images/wazuh-indexer/config/roles_mapping.yml b/build-docker-images/wazuh-indexer/config/roles_mapping.yml index 7d8429cb..6f893132 100644 --- a/build-docker-images/wazuh-indexer/config/roles_mapping.yml +++ b/build-docker-images/wazuh-indexer/config/roles_mapping.yml @@ -1,6 +1,6 @@ --- -# In this file users, backendroles and hosts can be mapped to Open Distro Security roles. -# Permissions for Opendistro roles are configured in roles.yml +# In this file users, backendroles and hosts can be mapped to Wazuh indexer Security roles. +# Permissions for Wazuh indexer roles are configured in roles.yml _meta: type: "rolesmapping" diff --git a/multi-node/config/wazuh_indexer/wazuh1.indexer.yml b/multi-node/config/wazuh_indexer/wazuh1.indexer.yml index b3fdcf1f..8e1953db 100644 --- a/multi-node/config/wazuh_indexer/wazuh1.indexer.yml +++ b/multi-node/config/wazuh_indexer/wazuh1.indexer.yml @@ -36,6 +36,6 @@ plugins.security.restapi.roles_enabled: - "security_rest_api_access" plugins.security.allow_default_init_securityindex: true cluster.routing.allocation.disk.threshold_enabled: false -opendistro_security.audit.config.disabled_rest_categories: NONE -opendistro_security.audit.config.disabled_transport_categories: NONE +plugins.security.audit.config.disabled_rest_categories: NONE +plugins.security.audit.config.disabled_transport_categories: NONE compatibility.override_main_response_version: true diff --git a/multi-node/config/wazuh_indexer/wazuh2.indexer.yml b/multi-node/config/wazuh_indexer/wazuh2.indexer.yml index e7b8285f..f0472be3 100644 --- a/multi-node/config/wazuh_indexer/wazuh2.indexer.yml +++ b/multi-node/config/wazuh_indexer/wazuh2.indexer.yml @@ -36,6 +36,6 @@ plugins.security.restapi.roles_enabled: - "security_rest_api_access" plugins.security.allow_default_init_securityindex: true cluster.routing.allocation.disk.threshold_enabled: false -opendistro_security.audit.config.disabled_rest_categories: NONE -opendistro_security.audit.config.disabled_transport_categories: NONE +plugins.security.audit.config.disabled_rest_categories: NONE +plugins.security.audit.config.disabled_transport_categories: NONE compatibility.override_main_response_version: true \ No newline at end of file diff --git a/multi-node/config/wazuh_indexer/wazuh3.indexer.yml b/multi-node/config/wazuh_indexer/wazuh3.indexer.yml index 864acc26..15ca069e 100644 --- a/multi-node/config/wazuh_indexer/wazuh3.indexer.yml +++ b/multi-node/config/wazuh_indexer/wazuh3.indexer.yml @@ -36,6 +36,6 @@ plugins.security.restapi.roles_enabled: - "security_rest_api_access" plugins.security.allow_default_init_securityindex: true cluster.routing.allocation.disk.threshold_enabled: false -opendistro_security.audit.config.disabled_rest_categories: NONE -opendistro_security.audit.config.disabled_transport_categories: NONE +plugins.security.audit.config.disabled_rest_categories: NONE +plugins.security.audit.config.disabled_transport_categories: NONE compatibility.override_main_response_version: true \ No newline at end of file diff --git a/single-node/config/wazuh_indexer/wazuh.indexer.yml b/single-node/config/wazuh_indexer/wazuh.indexer.yml index ec3220ef..2f4de700 100644 --- a/single-node/config/wazuh_indexer/wazuh.indexer.yml +++ b/single-node/config/wazuh_indexer/wazuh.indexer.yml @@ -3,7 +3,6 @@ node.name: "wazuh.indexer" path.data: /var/lib/wazuh-indexer path.logs: /var/log/wazuh-indexer discovery.type: single-node -compatibility.override_main_response_version: true plugins.security.ssl.http.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/wazuh.indexer.pem plugins.security.ssl.http.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/wazuh.indexer.key plugins.security.ssl.http.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/root-ca.pem @@ -25,3 +24,8 @@ plugins.security.restapi.roles_enabled: - "security_rest_api_access" plugins.security.system_indices.enabled: true plugins.security.system_indices.indices: [".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opendistro-notifications-*", ".opendistro-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"] +plugins.security.allow_default_init_securityindex: true +cluster.routing.allocation.disk.threshold_enabled: false +plugins.security.audit.config.disabled_rest_categories: NONE +plugins.security.audit.config.disabled_transport_categories: NONE +compatibility.override_main_response_version: true \ No newline at end of file From 9674d022e1d6981fe20025624125e07de3d678b3 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Wed, 6 Apr 2022 17:16:50 -0300 Subject: [PATCH 2/6] Miscelanious fixes --- multi-node/Migration-to-Wazuh-4.3.md | 9 +++++---- multi-node/config/wazuh_indexer/wazuh1.indexer.yml | 2 -- multi-node/config/wazuh_indexer/wazuh2.indexer.yml | 2 -- multi-node/config/wazuh_indexer/wazuh3.indexer.yml | 2 -- single-node/config/wazuh_indexer/wazuh.indexer.yml | 2 -- 5 files changed, 5 insertions(+), 12 deletions(-) diff --git a/multi-node/Migration-to-Wazuh-4.3.md b/multi-node/Migration-to-Wazuh-4.3.md index 5b884743..97d49f0e 100644 --- a/multi-node/Migration-to-Wazuh-4.3.md +++ b/multi-node/Migration-to-Wazuh-4.3.md @@ -17,7 +17,12 @@ Assuming that you have a v4.2 production deployment, perform the following steps **4. Spin down the 4.2 environment.** `docker-compose -f production-cluster.yml down` +**Steps 5 and 6 can be done with the volume-migrator.sh script, specifying Docker version and project name as parameters.** + +Ex: $ multi-node/volume-migrator.sh 1.25.0 multi-node + **5. Run the volume create command:** create new indexer and Wazuh manager volumes using the `com.docker.compose.version` label value from the previous command. + ``` docker volume create \ --label com.docker.compose.project=multi-node \ @@ -345,10 +350,6 @@ docker container run --rm -it \ alpine ash -c "cd /from ; cp -avp . /to" ``` -**Steps 5 and 6 can be done with the volume-migrator.sh script, specifying Docker version and project name as parameters.** - -Ex: $ multi-node/volume-migrator.sh 1.25.0 multi-node - **7. Start the 4.3 environment.** ``` git checkout 4.3 diff --git a/multi-node/config/wazuh_indexer/wazuh1.indexer.yml b/multi-node/config/wazuh_indexer/wazuh1.indexer.yml index 8e1953db..d48c01d9 100644 --- a/multi-node/config/wazuh_indexer/wazuh1.indexer.yml +++ b/multi-node/config/wazuh_indexer/wazuh1.indexer.yml @@ -36,6 +36,4 @@ plugins.security.restapi.roles_enabled: - "security_rest_api_access" plugins.security.allow_default_init_securityindex: true cluster.routing.allocation.disk.threshold_enabled: false -plugins.security.audit.config.disabled_rest_categories: NONE -plugins.security.audit.config.disabled_transport_categories: NONE compatibility.override_main_response_version: true diff --git a/multi-node/config/wazuh_indexer/wazuh2.indexer.yml b/multi-node/config/wazuh_indexer/wazuh2.indexer.yml index f0472be3..43d82e6b 100644 --- a/multi-node/config/wazuh_indexer/wazuh2.indexer.yml +++ b/multi-node/config/wazuh_indexer/wazuh2.indexer.yml @@ -36,6 +36,4 @@ plugins.security.restapi.roles_enabled: - "security_rest_api_access" plugins.security.allow_default_init_securityindex: true cluster.routing.allocation.disk.threshold_enabled: false -plugins.security.audit.config.disabled_rest_categories: NONE -plugins.security.audit.config.disabled_transport_categories: NONE compatibility.override_main_response_version: true \ No newline at end of file diff --git a/multi-node/config/wazuh_indexer/wazuh3.indexer.yml b/multi-node/config/wazuh_indexer/wazuh3.indexer.yml index 15ca069e..2ca2ff17 100644 --- a/multi-node/config/wazuh_indexer/wazuh3.indexer.yml +++ b/multi-node/config/wazuh_indexer/wazuh3.indexer.yml @@ -36,6 +36,4 @@ plugins.security.restapi.roles_enabled: - "security_rest_api_access" plugins.security.allow_default_init_securityindex: true cluster.routing.allocation.disk.threshold_enabled: false -plugins.security.audit.config.disabled_rest_categories: NONE -plugins.security.audit.config.disabled_transport_categories: NONE compatibility.override_main_response_version: true \ No newline at end of file diff --git a/single-node/config/wazuh_indexer/wazuh.indexer.yml b/single-node/config/wazuh_indexer/wazuh.indexer.yml index 2f4de700..2a3136f1 100644 --- a/single-node/config/wazuh_indexer/wazuh.indexer.yml +++ b/single-node/config/wazuh_indexer/wazuh.indexer.yml @@ -26,6 +26,4 @@ plugins.security.system_indices.enabled: true plugins.security.system_indices.indices: [".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opendistro-notifications-*", ".opendistro-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"] plugins.security.allow_default_init_securityindex: true cluster.routing.allocation.disk.threshold_enabled: false -plugins.security.audit.config.disabled_rest_categories: NONE -plugins.security.audit.config.disabled_transport_categories: NONE compatibility.override_main_response_version: true \ No newline at end of file From 1e79861fecaed773c4a01bf089f69ef6374353f9 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Thu, 7 Apr 2022 16:56:08 -0300 Subject: [PATCH 3/6] Change readme for wazuh docker images builder --- build-docker-images/README.md | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/build-docker-images/README.md b/build-docker-images/README.md index 5839ac52..9860d8b0 100644 --- a/build-docker-images/README.md +++ b/build-docker-images/README.md @@ -3,11 +3,5 @@ This stack allows you to build the Wazuh manager, indexer, and dashboard images locally by running the command: ``` -$ docker-compose up -d --build -``` - -Once the image creation process is finished, a Wazuh single-node environment will be spinned up. It can be terminated with the following command: - -``` -$ docker-compose down -``` +$ docker-compose build +``` \ No newline at end of file From 5f078b6d2950a5c1660b892f8fc50502edf09d8d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alberto=20Rodr=C3=ADguez?= Date: Fri, 8 Apr 2022 19:49:10 +0200 Subject: [PATCH 4/6] Update README.md --- README.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 8419df5c..73943c58 100644 --- a/README.md +++ b/README.md @@ -9,11 +9,12 @@ In this repository you will find the containers to run: * Wazuh manager: it runs the Wazuh manager, Wazuh API and Filebeat OSS * Wazuh dashboard: provides a web user interface to browse through alerts data and allows you to visualize agents configuration and status. -* Wazuh indexer: Wazuh indexer container (working as a single-node cluster). **Be aware to increase the `vm.max_map_count` setting, as it's detailed in the [Wazuh documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#increase-max-map-count-on-your-host-linux).** +* Wazuh indexer: Wazuh indexer container (working as a single-node cluster or as a multi-node cluster). **Be aware to increase the `vm.max_map_count` setting, as it's detailed in the [Wazuh documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#increase-max-map-count-on-your-host-linux).** -In addition, a docker-compose file is provided to launch the containers mentioned above. - -* Wazuh indexer cluster. In the Wazuh indexer Dockerfile we can visualize variables to configure an Wazuh indexer Cluster. These variables are used in the file *config_cluster.sh* to set them in the *opensearch.yml* configuration file. You can see the meaning of the node variables and other cluster settings [here](https://opensearch.org/docs/latest/opensearch/cluster/). +The folder `build-docker-images` contains a README explaining how to build the Wazuh images and the necessary assets. +The folder `indexer-certs-creator` contains a README explaining how to create the certificates creator tool and the necessary assets. +The folder `single-node` contains a README explaining how to run a Wazuh environment with one Wazuh manager, one Wazuh indexer, and one Wazuh dashboard. +The folder `multi-node` contains a README explaining how to run a Wazuh environment with two Wazuh managers, three Wazuh indexer, and one Wazuh dashboard. ## Documentation From a4bd34e2029b4afcb3e06e460a8e7dbbdecf4a71 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 8 Apr 2022 16:17:10 -0300 Subject: [PATCH 5/6] Remove admin_privileges option --- README.md | 8 +++----- build-docker-images/wazuh-dashboard/Dockerfile | 3 +-- .../wazuh-dashboard/config/wazuh_app_config.sh | 1 - 3 files changed, 4 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 73943c58..f08f61fd 100644 --- a/README.md +++ b/README.md @@ -11,9 +11,9 @@ In this repository you will find the containers to run: * Wazuh dashboard: provides a web user interface to browse through alerts data and allows you to visualize agents configuration and status. * Wazuh indexer: Wazuh indexer container (working as a single-node cluster or as a multi-node cluster). **Be aware to increase the `vm.max_map_count` setting, as it's detailed in the [Wazuh documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#increase-max-map-count-on-your-host-linux).** -The folder `build-docker-images` contains a README explaining how to build the Wazuh images and the necessary assets. -The folder `indexer-certs-creator` contains a README explaining how to create the certificates creator tool and the necessary assets. -The folder `single-node` contains a README explaining how to run a Wazuh environment with one Wazuh manager, one Wazuh indexer, and one Wazuh dashboard. +The folder `build-docker-images` contains a README explaining how to build the Wazuh images and the necessary assets. +The folder `indexer-certs-creator` contains a README explaining how to create the certificates creator tool and the necessary assets. +The folder `single-node` contains a README explaining how to run a Wazuh environment with one Wazuh manager, one Wazuh indexer, and one Wazuh dashboard. The folder `multi-node` contains a README explaining how to run a Wazuh environment with two Wazuh managers, three Wazuh indexer, and one Wazuh dashboard. ## Documentation @@ -82,8 +82,6 @@ WAZUH_MONITORING_ENABLED=true # Custom settings to enable/disable wazuh-mo WAZUH_MONITORING_FREQUENCY=900 # Custom setting to set the frequency for wazuh-monitoring indices cron task WAZUH_MONITORING_SHARDS=2 # Configure wazuh-monitoring-* indices shards and replicas WAZUH_MONITORING_REPLICAS=0 # - -ADMIN_PRIVILEGES=true # App privileges ``` ## Directory structure diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index 8a40a99c..3853f180 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -78,8 +78,7 @@ ENV PATTERN="" \ WAZUH_MONITORING_ENABLED="" \ WAZUH_MONITORING_FREQUENCY="" \ WAZUH_MONITORING_SHARDS="" \ - WAZUH_MONITORING_REPLICAS="" \ - ADMIN_PRIVILEGES="" + WAZUH_MONITORING_REPLICAS="" # Create wazuh-dashboard user and group RUN getent group $GROUP || groupadd -r -g 1000 $GROUP diff --git a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh index 784f10eb..3b5f2f5d 100644 --- a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh +++ b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh @@ -36,7 +36,6 @@ declare -A CONFIG_MAP=( [wazuh.monitoring.frequency]=$WAZUH_MONITORING_FREQUENCY [wazuh.monitoring.shards]=$WAZUH_MONITORING_SHARDS [wazuh.monitoring.replicas]=$WAZUH_MONITORING_REPLICAS - [admin]=$ADMIN_PRIVILEGES ) for i in "${!CONFIG_MAP[@]}" From 67d2444a849aa101ef1dcde256fe2f68cbfb065c Mon Sep 17 00:00:00 2001 From: vcerenu Date: Mon, 11 Apr 2022 11:27:09 -0300 Subject: [PATCH 6/6] duplicate option in wazuh.indexer.yml --- single-node/config/wazuh_indexer/wazuh.indexer.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/single-node/config/wazuh_indexer/wazuh.indexer.yml b/single-node/config/wazuh_indexer/wazuh.indexer.yml index 1c04e7be..c2480ca4 100644 --- a/single-node/config/wazuh_indexer/wazuh.indexer.yml +++ b/single-node/config/wazuh_indexer/wazuh.indexer.yml @@ -26,5 +26,4 @@ plugins.security.restapi.roles_enabled: plugins.security.system_indices.enabled: true plugins.security.system_indices.indices: [".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opendistro-notifications-*", ".opendistro-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"] plugins.security.allow_default_init_securityindex: true -cluster.routing.allocation.disk.threshold_enabled: false -compatibility.override_main_response_version: true \ No newline at end of file +cluster.routing.allocation.disk.threshold_enabled: false \ No newline at end of file